Authentication flow in Spring Boot - Step-by-Step Execution

Concept Flow - Authentication flow

User submits login form

↓

Spring Security intercepts request

↓

AuthenticationManager checks credentials

↓

Create [Reject login

↓

Set Security Context

↓

Allow access to protected resource

This flow shows how Spring Boot handles user login: user submits credentials, system checks them, then grants or denies access.

Execution Sample

Spring Boot

POST /login with username and password
AuthenticationManager.authenticate(token)
If success, SecurityContextHolder.getContext().setAuthentication(auth)
Return success response
Else return error

This code handles a login request by checking credentials and setting the user as authenticated if valid.

Execution Table

Step	Action	Input	Result	Next Step
1	User submits login form	username=alice, password=1234	Request received	2
2	Spring Security intercepts request	Login request	Authentication token created	3
3	AuthenticationManager authenticates	Token with credentials	Credentials valid?	4
4	Check credentials	username=alice, password=1234	Yes	5
5	Create Authentication object	User details	Authentication created	6
6	Set Security Context	Authentication object	User marked authenticated	7
7	Return success response	Authenticated user	Access granted	END
8	If credentials invalid	Invalid password	AuthenticationException thrown	Return error response

💡 Execution stops after success response or error response is returned

Variable Tracker

Variable	Start	After Step 2	After Step 3	After Step 5	After Step 6	Final
username	null	alice	alice	alice	alice	alice
password	null	1234	1234	1234	1234	1234
authenticationToken	null	created	created	created	created	used
authentication	null	null	null	created	set in context	set in context
securityContext	empty	empty	empty	empty	holds authentication	holds authentication

Key Moments - 3 Insights

Why does Spring Security create an Authentication token before checking credentials?

The token holds the user input securely and standardizes the data format for the AuthenticationManager to process, as shown in step 2 and 3 of the execution_table.

What happens if the credentials are invalid?

An AuthenticationException is thrown and the flow jumps to returning an error response, as shown in step 8 of the execution_table.

Why do we set the Authentication object in the Security Context?

Setting it marks the user as authenticated for the current session, allowing access to protected resources, as shown in step 6.

Visual Quiz - 3 Questions

Look at the execution_table, what is the state of 'authentication' after step 5?

A Authentication token is created

B Authentication object is null

C Authentication object is created

D Security context is set

💡 Hint

Check the 'Result' column at step 5 in the execution_table

At which step does Spring Security decide if credentials are valid?

A Step 2

B Step 4

C Step 3

D Step 6

💡 Hint

Look at the 'Action' and 'Result' columns around steps 3 and 4 in the execution_table

If the password is wrong, which step shows the flow handling this?

A Step 8

B Step 7

C Step 5

D Step 6

💡 Hint

Check the row mentioning 'AuthenticationException' in the execution_table

Concept Snapshot

Authentication flow in Spring Boot:
1. User submits login form.
2. Spring Security creates an Authentication token.
3. AuthenticationManager checks credentials.
4. If valid, sets Authentication in Security Context.
5. Grants access; else returns error.
This flow secures protected resources by verifying identity.

Full Transcript

In Spring Boot, when a user submits a login form, Spring Security intercepts the request and creates an Authentication token holding the credentials. The AuthenticationManager then checks these credentials. If they are valid, an Authentication object is created and set in the Security Context, marking the user as authenticated. The system then grants access to protected resources. If credentials are invalid, an exception is thrown and an error response is returned. This flow ensures only authenticated users can access secured parts of the application.

Practice

1. What is the main purpose of the authentication flow in a Spring Boot application?

easy

A. To send emails to users after login

B. To style the user interface of the login page

C. To store user data in the database

D. To verify the identity of a user before granting access

Solution

1. Step 1: Understand authentication flow purpose

   Authentication flow is about checking who the user is before allowing access.

2. Step 2: Identify correct purpose in options

   Only To verify the identity of a user before granting access describes verifying user identity, which matches authentication.

3. Final Answer:

   To verify the identity of a user before granting access -> Option D

4. Quick Check:

   Authentication = Verify user identity [OK]

Hint: Authentication means checking who the user is [OK]

Common Mistakes:

• Confusing authentication with styling or data storage
• Thinking authentication sends emails
• Mixing authentication with authorization

2. Which of the following is the correct way to configure URL access rules in Spring Security?

easy

A. http.authorizeHttpRequests().requestMatchers("/admin/**").authenticated()

B. http.authorizeRequests().antMatchers("/private/**").denyAll()

C. http.authorizeRequests().anyRequest().allow()

D. http.authorizeRequests().requestMatchers("/public/**").permitAll()

Solution

1. Step 1: Identify correct method for URL rules in Spring Security

   Spring Security 6+ uses http.authorizeHttpRequests() with requestMatchers() for URL patterns.

2. Step 2: Check which option uses correct syntax and meaning

   http.authorizeHttpRequests().requestMatchers("/admin/**").authenticated() uses authorizeHttpRequests() and requestMatchers() with authenticated(), which is correct.

3. Final Answer:

   http.authorizeHttpRequests().requestMatchers("/admin/**").authenticated() -> Option A

4. Quick Check:

   Use authorizeHttpRequests() + requestMatchers() [OK]

Hint: Use authorizeHttpRequests() with requestMatchers() in Spring Security 6+ [OK]

Common Mistakes:

• Using deprecated authorizeRequests() in new Spring versions
• Using denyAll() incorrectly for access control
• Using anyRequest().allow() which is invalid

3. Given this Spring Security configuration snippet, what happens when a user accesses /dashboard without logging in?

http
  .authorizeHttpRequests(auth -> auth
    .requestMatchers("/public/**").permitAll()
    .anyRequest().authenticated()
  )
  .formLogin();

medium

A. The user can access /dashboard without login

B. The user is redirected to the login page

C. The user gets a 403 Forbidden error

D. The user sees a blank page

Solution

1. Step 1: Analyze URL access rules

   /public/** URLs are open, but any other request requires authentication.

2. Step 2: Check behavior for unauthenticated access to /dashboard

   Since /dashboard is not under /public, it requires login. formLogin() triggers redirect to login page.

3. Final Answer:

   The user is redirected to the login page -> Option B

4. Quick Check:

   Unauthenticated access redirects to login [OK]

Hint: AnyRequest().authenticated() means login required [OK]

Common Mistakes:

• Thinking permitAll() applies to all URLs
• Expecting 403 error instead of redirect
• Assuming access without login

4. Identify the error in this Spring Security configuration snippet:

http
  .authorizeHttpRequests(auth -> auth
    .requestMatchers("/admin/**").permitAll()
    .anyRequest().authenticated()
  )
  .formLogin();

medium

A. formLogin() is missing a login page URL

B. anyRequest().authenticated() should come before requestMatchers()

C. permitAll() on /admin/** allows unrestricted access to admin pages

D. requestMatchers() should be replaced with antMatchers()

Solution

1. Step 1: Review access rules for /admin/**

   permitAll() means anyone can access /admin/** without login, which is usually a security risk.

2. Step 2: Check order and methods

   Order is correct; anyRequest().authenticated() applies after permitAll(). formLogin() without URL uses default login page, which is valid.

3. Final Answer:

   permitAll() on /admin/** allows unrestricted access to admin pages -> Option C

4. Quick Check:

   permitAll() means open access [OK]

Hint: permitAll() means no login needed, risky on admin URLs [OK]

Common Mistakes:

• Thinking order of matchers is wrong here
• Assuming formLogin() needs explicit URL
• Confusing requestMatchers() with antMatchers()

5. You want to create a custom authentication flow that checks a user's email and password against a database and then grants access. Which Spring Boot component should you implement to handle this logic?

hard

A. UserDetailsService to load user data and PasswordEncoder to check password

B. AuthenticationEntryPoint to redirect users after login

C. CorsConfiguration to allow cross-origin requests

D. HttpFirewall to block unauthorized IP addresses

Solution

1. Step 1: Identify component for loading user info

   UserDetailsService is designed to load user details like email and password from a database.

2. Step 2: Identify component for password checking

   PasswordEncoder is used to verify the password matches the stored hash securely.

3. Step 3: Confirm other options are unrelated

   AuthenticationEntryPoint handles unauthorized access, not authentication logic. CorsConfiguration and HttpFirewall serve different purposes.

4. Final Answer:

   UserDetailsService to load user data and PasswordEncoder to check password -> Option A

5. Quick Check:

   Custom auth uses UserDetailsService + PasswordEncoder [OK]

Hint: UserDetailsService loads users; PasswordEncoder checks passwords [OK]

Common Mistakes:

• Confusing AuthenticationEntryPoint with authentication logic
• Using CorsConfiguration for authentication
• Thinking HttpFirewall handles login checks